Description

Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T13:17:45.027Z",
  "pubdate": "2026-08-13T13:17:45.027Z",
  "executiveSummary": "An integer wraparound vulnerability exists in 32-bit builds of PostgreSQL affecting the pltcl and plperl procedural languages. The vulnerability enables a malicious database object creator to trigger an undersized memory allocation during the processing of crafted function bodies, resulting in an out-of-bounds memory write. Successful exploitation allows an authenticated attacker with object creation privileges to execute arbitrary operating system code within the security context of the user running the database server. This issue shares similarities with problems previously addressed under CVE-2026-6473. Affected software includes PostgreSQL versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24. The risk implications are severe, leading to complete database compromise and potential lateral movement within the underlying operating system environment. Exploitation requires the ability to create database objects and targets 32-bit architecture deployments utilizing pltcl or plperl.",
  "technicalDetails": "The root cause of the vulnerability is an integer wraparound flaw occurring specifically within 32-bit builds of PostgreSQL when handling pltcl and plperl function definitions. When processing crafted function bodies, the internal calculation for memory buffer sizing fails to properly account for integer boundaries, leading to an arithmetic overflow or wraparound condition. This improper calculation causes the database server to allocate a memory buffer that is significantly smaller than required for the incoming data.\nThe vulnerable components reside within the pltcl and plperl procedural language handlers responsible for parsing and preparing function bodies. Attackers with privileges to create database objects, such as functions or procedures, can supply specially crafted payloads designed to trigger the calculation error. During the memory allocation phase, the undersized buffer is allocated, and subsequent copy or write operations write past the bounds of the allocated buffer, causing heap corruption or overwriting critical memory structures.\nThe attack flow proceeds as follows: First, the authenticated attacker establishes a connection to the PostgreSQL database with sufficient privileges to create database objects. Second, the attacker defines a new function utilizing either pltcl or plperl, embedding a crafted function body designed to manipulate memory sizing calculations. Third, when the database server compiles, processes, or executes the malicious function, the integer wraparound triggers an undersized memory allocation. Fourth, the subsequent out-of-bounds write corrupts adjacent memory regions. Finally, the attacker leverages this memory corruption to achieve arbitrary code execution under the privileges of the operating system user running the database daemon.\nAuthentication and privilege requirements include valid database credentials and the specific ability to create database objects, which may be granted by default in certain configurations or specifically assigned to untrusted users. The vulnerability impacts 32-bit builds across PostgreSQL versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24. Post-exploitation impact encompasses full system compromise, data exfiltration, modification of database contents, and potential escalation of privileges on the host operating system."
}